Use Microsoft Defender for Office 365 together with Microsoft Defender for Endpoint

Tip

Did you know you can try the features in Microsoft 365 Defender for Office 365 Plan 2 for free? Use the 90-day Defender for Office 365 trial at the Microsoft 365 Defender portal trials hub. Learn about who can sign up and trial terms here.

Microsoft Defender for Office 365 can be configured to work with Microsoft Defender for Endpoint.

Integrating Microsoft Defender for Office 365 with Microsoft Defender for Endpoint can help your security operations team monitor and take action quickly if users' devices are at risk. For example, once integration is enabled, your security operations team will be able to see the devices that are potentially affected by a detected email message, as well as how many recent alerts were generated for those devices in Microsoft Defender for Endpoint.

The following image depicts what the Devices tab looks like when you have Microsoft Defender for Endpoint integration enabled:

A list of devices with alerts

In this example, you can see that the recipients of the detected email message have four devices and one has an alert. Clicking the link for a device opens its page in the Microsoft 365 Defender portal.

Tip

The Microsoft 365 Defender portal replaces the Microsoft Defender Security Center. See Microsoft Defender for Endpoint in Microsoft 365 Defender.

Requirements

To integrate Microsoft Defender for Office 365 with Microsoft Defender for Endpoint

Integrating Microsoft Defender for Office 365 with Microsoft Defender for Endpoint is set up in both Defender for Endpoint and Defender for Office 365.

  1. Go to the Microsoft 365 Defender portal (https://security.microsoft.com) and sign in.

  2. Go to Email & collaboration > Explorer.

  3. On the Explorer page, in the upper right corner of the screen, select MDE Settings.

  4. In the Microsoft Defender for Endpoint connection flyout that appears, turn on Connect to Microsoft Defender for Endpoint (Toggle on.) and then select Close.

    The MDE Connection page

  5. In the navigation pane, choose Settings. On the Settings page, choose Endpoints

  6. On the Endpoints page that opens, choose Advanced features.

  7. Scroll down to Office 365 Threat Intelligence connection, and turn it on (Toggle on.).

    When you're finished, select Save preferences.

See also

Threat investigation and response capabilities in Office 365

Microsoft Defender for Office 365

Microsoft Defender for Endpoint